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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed April 9, 
2007. Claims 1-39 were pending in the Application. In the Office Action, Claims 1-39 were 
rejected. In order to expedite prosecution, Claims 14, 15, 19, and 31 are amended. Thus, 
Claims 1-39 remain pending in the Application. Applicants respectfully request reconsideration 
and favorable action in this case. 

In the Office Action, the following actions were taken or matters were raised: 

CLAIM OBJECTIONS 

The Examiner objected to Claims 19 and 31 because of informalities associated with 
antecedent basis. Claims 19 and 31 are amended to correct the antecedent basis deficiencies. 
Applicants submit that the amendments to Claims 19 and 31 are not based on any cited or 
applied references and, therefore, do not change or otherwise narrow the scope of Claims 1 9 
and 31 . Applicants respectfully request that these objections be withdrawn. 

SECTION 102 REJECTIONS 

Claims 1, 3-11, 13, 14-17, 19-21, 23-29, 31-32, 34-37 and 39 were rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Patent No. 6978,385 issued to Cheston et al. 
(hereinafter "Cheston"). Applicants respectfully traverse this rejection. 

Under 35 U.S.C. § 102, a claim is anticipated only if each and every element as set forth 
in the claim is found in a single prior art reference. Verdegaal Bros. v. Union Oil Co. of 
California, 2 U.S.P.Q.2d 1051 (Fed. Cir. 1987); M.P.E.P. § 2131. In addition, "[t]he /cfentical 
invention must be shown in as complete detail as is contained in the . . . claims" and "[t]he 
elements must be arranged as required by the claim." Richardson v. Suzuki Motor Co., 9 
U.S.P.Q.2d 1913, 1920 (Fed. Cir. 1989); In re Bond, 15 U.S.P.Q.2d 1566 (Fed. Cir. 1990); 
M.P.E.P. §2131. 

Of the rejected claims, Claims 1, 14, 19, and 31 are independent. Independent Claim 1 
recites "a security module adapted to control access to a secure computer resource by a user 
via a client based on verification of a security credential provided by the user" and " verification 
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data disposed on the client and accessible by the security module , the security module adapted 
to enable the user to recover the security credential based on a response received from the 
user associated with the verification data" (emphasis added). Applicants respectfully submit 
that the Examiner has failed to establish a prima facie anticipation rejection of Claim 1. In the 
Office Action, the Examiner appears to assert that Cheston discloses the limitation of 
"verification data disposed on the client and accessible by the security module" by referring to 
two limitations recited in Claims 19 and 31. (Office Action dated April 9, 2007, page 2-3). 
Specifically, the Examiner appears to assert that the limitation in Claim 1 is equivalent to the 
limitation of a "collection module adapted to receive and store verification data associated with 
a user on a client" as recited in Claim 31 and the limitation of "presenting verification data 
disposed on the client to the user" as recited in Claim 19. (Id.). The two limitations in Claims 
19 and 31 are not expressly present in Claim 1. (Id.). Applicants respectfully remind the 
Examiner that a claim is anticipated only if each and every element as set forth and arranged in 
the claim is found in a single prior art reference. (See Verdegall Bros., 2 U.S.P.Q.2d at 1051; 
Richardson, U.S.P.Q.2d at 1920; In re Bond, 15 U.S.P.Q.2d at 1566; MPEP § 2131). 
Applicants respectfully submit that limitations set forth and recited differently in Claims 19 and 
31 are not equivalent to the limitations as recited in Claim 1 . The Examiner has not specified 
how or in what manner Cheston discloses the limitation of "verification data disposed on the 
client and accessible by the security module" as recited in Claim 1. Therefore, the Examiner 
has failed to establish a prima facie anticipation rejection of Claim 1. Accordingly, for at least 
this reason, Applicants respectfully request that the rejection of Claim 1 be withdrawn. 

Nonetheless, Applicants respectfully submit that Cheston does not disclose or even 
suggest all the limitations recited in Claim 1. For example, the Cheston device uses a set of 
encryption keys (e.g., public/private key set) to control and manage the primary passwords for a 
user to gain access to a client computer system. (Cheston, column 5, lines 12-22; column 6, 
lines 31 through column 7, line 7). The client computer in Cheston apparently receives a set of 
client passwords (e.g., a login password, challenge question, and answer to the challenge 
question). (Id., column 6, lines 55-61). The client computer encrypts the set of client 
passwords and passes them on to a server to be stored. (Id., column 6, lines 55-61 and column 
7, lines 8-36). When a user attempts to log into the client computer in the future, the client 
computer transmits a message with the password and/or challenge question and answer for 
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verification bv the server . (Id., column 7, line 38 through column 8, line 19) (emphasis added). 
The client computer itself in Cheston does not appear to maintain or verify the set of client 
passwords. (Id). Instead, the server in Cheston appears to maintain and verify the information 
and transmits a notice to the client computer indicating whether the set of client passwords is 
valid or not. (Id.). In contrast, Claim 1 recites a computer security system comprising 
" verification data disposed on the client and accessible bv the security module " (emphasis 
added). Cheston does not appear to disclose or suggest this limitation. Accordingly, at least 
for this reason, Claim 1 is patentable over the reference. 

Amended independent Claim 14 recites a "means for controlling access to a secure 
computer resource associated with a client based on verification of a security credential 
provided by a user of the client" and a "means for accessing verification data disposed on the 
client to enable the user to recover the security credential based on a response received from 
the user via the controlling means" (emphasis added). For at least the reasons discussed in 
connection with independent Claim 1, Applicants respectfully submit that Claim 14 is also 
patentable over the reference. 

Independent Claim 19 recites "receiving a request at a client to access a secure 
computer resource, a security credential required from the user to access the secure computer 
resource;" " presenting verification data disposed on the client to the user;" and " enabling the 
user to recover the security credential based on a response received from the user to the 
verification data" (emphasis added). For at least the reasons discussed in connection with 
independent Claim 1, Applicants respectfully submit that Claim 19 is also patentable over the 
reference. 

Independent Claim 31 recites "a collection module adapted to receive and store 
verification data associated with a user on a client " and "a recovery module adapted to enable 
the user to recover a security credential associated with accessing a secure computer resource 
via the client by verifying a user response to the verification data" (emphasis added). For at 
least the reasons discussed in connection with independent Claim 1, Applicants respectfully 
submit that Claim 31 is also patentable over the reference. 
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Claims 3-11, 13, 15-17, 20-21, 23-29, 32, 34-37, and 39 depend respectively from 
independent Claims 1, 14, 19, and 31 and therefore are also patentable over the references at 
least because they incorporate the limitations of respective Claims 1, 14, 19, and 31 and also 
recite additional limitations that further distinguish the references. Accordingly, Applicants 
respectfully request that the rejections of Claims 1,3-11,13, 14-17, 19-21, 23-29, 31-32, 34- 
37 and 39 under 35 U.S.C. 103(a) be withdrawn. 

SECTION 103 REJECTIONS 

Claims 2, 12, 18, 22, 30, 33 and 38 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over Cheston in view of U.S. Patent Publication No. 2004/0030932 issued to 
Juels et al. (hereinafter "Juels"). Applicants respectfully traverse this rejection. 

Claims 2, 12, 18, 22, 30, 33 and 38 depend respectively from independent Claims 1, 
14, 19, and 31. As shown above, Claims 1, 14, 19, and 31 are in condition for allowance. 
Therefore, for at least this reason, Claims 2, 12, 18, 22, 30, 33 and 38 that depend 
respectively from independent Claims 1, 14, 19, and 31 are allowable. Accordingly, Applicants 
respectfully request that the rejection of Claims 2, 12, 18, 22, 30, 33 and 38 be withdrawn. 
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CONCLUSION 



Applicants have made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicants 
respectfully request reconsideration and full allowance of all pending claims. 

No fee is believed due with this Response. If, however, Applicants have overlooked the 
need for any fee due with this Response, the Commissioner is hereby authorized to charge any 
fees or credit any overpayment associated with this Response to Deposit Account No. 08-2025 
of Hewlett-Packard Company. 



Date: July 9, 2007 

Hewlett-Packard Company 
Intellectual Property Administration 
P. O. Box 272400 
Fort Collins, CO 80527-2400 
Tel. 970-898-3884 



Respectfully submitted, 



By: 




Hope Snimabuku 
Reg. No. 57,072 
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